Gitlab -- vulnerabilities

Gitlab reports: Restrict group access token creation for custom roles Project maintainers can bypass group's scan result policy blockbranchmodification setting ReDoS in CI/CD Pipeline Editor while verifying Pipeline syntax Resource exhaustion using GraphQL vulnerabilitiesCountByDay...

Argus - A Framework for Staged Static Taint Analysis of GitHub Workflows and Actions

This repo contains the code for our USENIX Security '23 paper "ARGUS: A Framework for Staged Static Taint Analysis of GitHub Workflows and Actions". Argus is a comprehensive security analysis tool specifically designed for GitHub Actions. Built with an aim to enhance the security of CI/CD...

GHSA-XW73-RW38-6VJC Classic builder cache poisoning

The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions most important being HEALTHCHECK and ONBUILD would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache...

Raven - CI/CD Security Analyzer

RAVEN Risk Analysis andVulnerability Enumeration for CI/CD is a powerful security tool designed to perform massive scans for GitHub Actions CI workflows and digest the discovered data into a Neo4j database. Developed and maintained by the Cycode research team. With Raven, we were able to identify...

TensorFlow CI/CD Flaw Exposed Supply Chain to Poisoning Attacks

Continuous integration and continuous delivery CI/CD misconfigurations discovered in the open-source TensorFlow machine learning framework could have been exploited to orchestrate supply chain attacks. The misconfigurations could be abused by an attacker to "conduct a supply chain compromise of...

Malware in ember-cli-progress-ci

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

PT-2024-12911

exploit 1. CVE-2023-40713: Exploiting GOG Galaxy XPC service for privilege escalation in macOS https://securityintelligence.com/x-force/exploiting-gog-galaxy-xpc-service-privilege-escalation-macos 2. CVE-2023-6560: io uring io uaddr map Dangerous Multi-Page Handling...

Malicious code in ember-cli-progress-ci (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54512754f5c019f13ce9e5c3554ccdc6180846834e3f02daa24abb228033fc95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-47 Malicious code in ember-cli-progress-ci (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54512754f5c019f13ce9e5c3554ccdc6180846834e3f02daa24abb228033fc95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GitLab 13.7 < 13.12.9 / 14.0 < 14.0.7 / 14.1 < 14.1.2 (CVE-2021-22252)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers...

GitLab 12.0 < 14.10.5 / 15.0 < 15.0.4 / 15.1 < 15.1.1 (CVE-2022-2228)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Information exposure in GitLab EE affecting all versions from 12.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker with the appropriate access tokens to obtain CI...

GitLab 1.0.2 < 14.8.6 / 14.9.0 < 14.9.4 / 14.10.0 < 14.10.1 (CVE-2022-1423)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0...

Unauthorized Access

GitLab is vulnerable to Unauthorized Access.The vulnerability is caused due to improper access controls. This could allows an attacker to access sensitive information within private projects,configurations, and other confidential data associated with CI/CD jobs...

Information Disclosure

GitLab EE is vulnerable to Information Disclosure.The vulnerability is caused due to improper authorization. It was possible for an unauthorised project or group member to read the CI/CD variables using the custom project templates...

Denial Of Service

gitlab:sid is vulnerable to Denial of Service. The vulnerability due to point a CI/CD Component to an incorrect path and cause the server to exhaust all available memory through an infinite loop. it allows an attacker to cause Denial of Service...

Buildkite Elastic CI for AWS symbolic link following vulnerability

A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

GHSA-R5HG-349Q-MG2Q Buildkite Elastic CI for AWS time-of-check-time-of-use race condition vulnerability

A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

CVE-2023-43741

A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

CVE-2023-43116

A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...

CVE-2023-43741

A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINEPATH variable in the fix-buildkite-agent-builds-permissions script...